Skip to content

Commit 977f65e

Browse files
mrWinstonmrWinston
committed
add network security perimeter to some resources
1 parent 0e171f6 commit 977f65e

13 files changed

+372
-19
lines changed

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ require (
1515
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault v1.5.0
1616
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0
1717
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0
18+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0
1819
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1
1920
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0
2021
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0 h1:L7G3d
3232
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0/go.mod h1:Ms6gYEy0+A2knfKrwdatsggTXYA2+ICKug8w7STorFw=
3333
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0 h1:HYGD75g0bQ3VO/Omedm54v4LrD3B1cGImuRF3AJ5wLo=
3434
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0/go.mod h1:ulHyBFJOI0ONiRL4vcJTmS7rx18jQQlEPmAgo80cRdM=
35+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0 h1:qZQVUcgr3ZUsyt8lf4FS+Wjj1NxyPaMY7Nj/3UiFgO4=
36+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0/go.mod h1:vbbC5kaJ8H3mz4GIXafT5thlUo2qzW46Zzl1dKKpZVk=
3537
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
3638
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
3739
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=

‎pkg/deploy/assets/gateway-production-predeploy.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,39 @@
115115
"enableSoftDelete": true
116116
},
117117
"apiVersion": "2019-09-01"
118+
},
119+
{
120+
"apiVersion": "2024-07-01",
121+
"location": "[resourceGroup().location]",
122+
"name": "gateway-nsp",
123+
"properties": {},
124+
"type": "Microsoft.Network/networkSecurityPerimeters"
125+
},
126+
{
127+
"apiVersion": "2024-07-01",
128+
"dependsOn": [
129+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'gateway-nsp')]"
130+
],
131+
"name": "gateway-nsp/default",
132+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
133+
},
134+
{
135+
"apiVersion": "2024-07-01",
136+
"dependsOn": [
137+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'gateway-nsp', 'default')]",
138+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-gwy'))]"
139+
],
140+
"name": "gateway-nsp/gateway-keyvault",
141+
"properties": {
142+
"accessMode": "Learning",
143+
"privateLinkResource": {
144+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-gwy'))]"
145+
},
146+
"profile": {
147+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'gateway-nsp', 'default')]"
148+
}
149+
},
150+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
118151
}
119152
]
120153
}

‎pkg/deploy/assets/rp-development-predeploy.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,75 @@
322322
]
323323
}
324324
}
325+
},
326+
{
327+
"apiVersion": "2024-07-01",
328+
"location": "[resourceGroup().location]",
329+
"name": "aro-keyvaults-nsp",
330+
"properties": {},
331+
"type": "Microsoft.Network/networkSecurityPerimeters"
332+
},
333+
{
334+
"apiVersion": "2024-07-01",
335+
"dependsOn": [
336+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'aro-keyvaults-nsp')]"
337+
],
338+
"name": "aro-keyvaults-nsp/default",
339+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
340+
},
341+
{
342+
"apiVersion": "2024-07-01",
343+
"dependsOn": [
344+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
345+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
346+
],
347+
"name": "aro-keyvaults-nsp/nsp-cls",
348+
"properties": {
349+
"accessMode": "Learning",
350+
"privateLinkResource": {
351+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
352+
},
353+
"profile": {
354+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
355+
}
356+
},
357+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
358+
},
359+
{
360+
"apiVersion": "2024-07-01",
361+
"dependsOn": [
362+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
363+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
364+
],
365+
"name": "aro-keyvaults-nsp/nsp-por",
366+
"properties": {
367+
"accessMode": "Learning",
368+
"privateLinkResource": {
369+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
370+
},
371+
"profile": {
372+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
373+
}
374+
},
375+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
376+
},
377+
{
378+
"apiVersion": "2024-07-01",
379+
"dependsOn": [
380+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
381+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
382+
],
383+
"name": "aro-keyvaults-nsp/nsp-svc",
384+
"properties": {
385+
"accessMode": "Learning",
386+
"privateLinkResource": {
387+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
388+
},
389+
"profile": {
390+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
391+
}
392+
},
393+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
325394
}
326395
]
327396
}

‎pkg/deploy/assets/rp-development.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,39 @@
117117
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
118118
]
119119
},
120+
{
121+
"apiVersion": "2024-07-01",
122+
"location": "[resourceGroup().location]",
123+
"name": "cosmos-nsp",
124+
"properties": {},
125+
"type": "Microsoft.Network/networkSecurityPerimeters"
126+
},
127+
{
128+
"apiVersion": "2024-07-01",
129+
"dependsOn": [
130+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'cosmos-nsp')]"
131+
],
132+
"name": "cosmos-nsp/default",
133+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
134+
},
135+
{
136+
"apiVersion": "2024-07-01",
137+
"dependsOn": [
138+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]",
139+
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
140+
],
141+
"name": "cosmos-nsp/cosmos-nsp-association",
142+
"properties": {
143+
"accessMode": "Learning",
144+
"privateLinkResource": {
145+
"id": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
146+
},
147+
"profile": {
148+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]"
149+
}
150+
},
151+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
152+
},
120153
{
121154
"name": "[guid(resourceGroup().id, parameters('rpServicePrincipalId'), 'RP / Reader')]",
122155
"type": "Microsoft.Authorization/roleAssignments",

‎pkg/deploy/assets/rp-production-predeploy.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,6 +319,75 @@
319319
}
320320
}
321321
},
322+
{
323+
"apiVersion": "2024-07-01",
324+
"location": "[resourceGroup().location]",
325+
"name": "aro-keyvaults-nsp",
326+
"properties": {},
327+
"type": "Microsoft.Network/networkSecurityPerimeters"
328+
},
329+
{
330+
"apiVersion": "2024-07-01",
331+
"dependsOn": [
332+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'aro-keyvaults-nsp')]"
333+
],
334+
"name": "aro-keyvaults-nsp/default",
335+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
336+
},
337+
{
338+
"apiVersion": "2024-07-01",
339+
"dependsOn": [
340+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
341+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
342+
],
343+
"name": "aro-keyvaults-nsp/nsp-cls",
344+
"properties": {
345+
"accessMode": "Learning",
346+
"privateLinkResource": {
347+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
348+
},
349+
"profile": {
350+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
351+
}
352+
},
353+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
354+
},
355+
{
356+
"apiVersion": "2024-07-01",
357+
"dependsOn": [
358+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
359+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
360+
],
361+
"name": "aro-keyvaults-nsp/nsp-por",
362+
"properties": {
363+
"accessMode": "Learning",
364+
"privateLinkResource": {
365+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
366+
},
367+
"profile": {
368+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
369+
}
370+
},
371+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
372+
},
373+
{
374+
"apiVersion": "2024-07-01",
375+
"dependsOn": [
376+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
377+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
378+
],
379+
"name": "aro-keyvaults-nsp/nsp-svc",
380+
"properties": {
381+
"accessMode": "Learning",
382+
"privateLinkResource": {
383+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
384+
},
385+
"profile": {
386+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
387+
}
388+
},
389+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
390+
},
322391
{
323392
"properties": {
324393
"protocol": "Tcp",

‎pkg/deploy/assets/rp-production.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1178,6 +1178,39 @@
11781178
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
11791179
]
11801180
},
1181+
{
1182+
"apiVersion": "2024-07-01",
1183+
"location": "[resourceGroup().location]",
1184+
"name": "cosmos-nsp",
1185+
"properties": {},
1186+
"type": "Microsoft.Network/networkSecurityPerimeters"
1187+
},
1188+
{
1189+
"apiVersion": "2024-07-01",
1190+
"dependsOn": [
1191+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'cosmos-nsp')]"
1192+
],
1193+
"name": "cosmos-nsp/default",
1194+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
1195+
},
1196+
{
1197+
"apiVersion": "2024-07-01",
1198+
"dependsOn": [
1199+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]",
1200+
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
1201+
],
1202+
"name": "cosmos-nsp/cosmos-nsp-association",
1203+
"properties": {
1204+
"accessMode": "Learning",
1205+
"privateLinkResource": {
1206+
"id": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
1207+
},
1208+
"profile": {
1209+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]"
1210+
}
1211+
},
1212+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
1213+
},
11811214
{
11821215
"name": "[guid(resourceGroup().id, parameters('rpServicePrincipalId'), 'RP / Reader')]",
11831216
"type": "Microsoft.Authorization/roleAssignments",

‎pkg/deploy/generator/resources.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package generator
66
import (
77
"fmt"
88

9+
sdknetwork "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7"
910
mgmtdns "github.com/Azure/azure-sdk-for-go/services/dns/mgmt/2018-05-01/dns"
1011
mgmtkeyvault "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2019-09-01/keyvault"
1112
mgmtnetwork "github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-08-01/network"
@@ -44,6 +45,56 @@ func (g *generator) dnsZone(name string) *arm.Resource {
4445
}
4546
}
4647

48+
func (g *generator) networkSecurityPerimeter(name string) *arm.Resource {
49+
50+
return &arm.Resource{
51+
Resource: &sdknetwork.SecurityPerimeter{
52+
Location: pointerutils.ToPtr("[resourceGroup().location]"),
53+
Properties: &sdknetwork.SecurityPerimeterProperties{},
54+
Name: &name,
55+
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters"),
56+
},
57+
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters"),
58+
}
59+
}
60+
61+
// networkSecurityPerimeterProfile creates a new nsp profile with the hardcoded name `default`.
62+
func (g *generator) networkSecurityPerimeterProfile(nspName string) *arm.Resource {
63+
return &arm.Resource{
64+
Resource: &sdknetwork.NspProfile{
65+
Name: pointerutils.ToPtr(fmt.Sprintf("%s/default", nspName)),
66+
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters/profiles"),
67+
},
68+
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters/profiles"),
69+
DependsOn: []string{
70+
fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters', '%s')]", nspName),
71+
},
72+
}
73+
}
74+
75+
func (g *generator) networkSecurityPerimeterAssociation(nspName string, associationName string, targetResourceId string) *arm.Resource {
76+
return &arm.Resource{
77+
Resource: &sdknetwork.NspAssociation{
78+
Properties: &sdknetwork.NspAssociationProperties{
79+
AccessMode: pointerutils.ToPtr(sdknetwork.AssociationAccessModeLearning),
80+
PrivateLinkResource: &sdknetwork.SubResource{
81+
ID: &targetResourceId,
82+
},
83+
Profile: &sdknetwork.SubResource{
84+
ID: pointerutils.ToPtr(fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', '%s', 'default')]", nspName)),
85+
},
86+
},
87+
Name: pointerutils.ToPtr(fmt.Sprintf("%s/%s", nspName, associationName)),
88+
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters/resourceAssociations"),
89+
},
90+
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters/resourceAssociations"),
91+
DependsOn: []string{
92+
fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', '%s', 'default')]", nspName),
93+
targetResourceId,
94+
},
95+
}
96+
}
97+
4798
func (g *generator) securityGroup(name string, securityRules *[]mgmtnetwork.SecurityRule, condition interface{}) *arm.Resource {
4899
return &arm.Resource{
49100
Resource: &mgmtnetwork.SecurityGroup{

‎pkg/deploy/generator/resources_gateway.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,23 @@ func (g *generator) gatewayManagedIdentity() *arm.Resource {
3232
}
3333
}
3434

35+
func (g *generator) gatewayKeyvaultPerimeterAssociation() *arm.Resource {
36+
gwKvResId := fmt.Sprintf(
37+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '%s'))]",
38+
env.GatewayKeyvaultSuffix,
39+
)
40+
41+
return g.networkSecurityPerimeterAssociation("gateway-nsp", "gateway-keyvault", gwKvResId)
42+
}
43+
44+
func (g *generator) gatewayNetworkSecurityPerimeterProfile() *arm.Resource {
45+
return g.networkSecurityPerimeterProfile("gateway-nsp")
46+
}
47+
48+
func (g *generator) gatewayNetworkSecurityPerimeter() *arm.Resource {
49+
return g.networkSecurityPerimeter("gateway-nsp")
50+
}
51+
3552
func (g *generator) gatewaySecurityGroup() *arm.Resource {
3653
return g.securityGroup("gateway-nsg", nil, g.conditionStanza("deployNSGs"))
3754
}

0 commit comments

Comments
 (0)